Broken Access: On the Challenges of Screen Reader Assisted Two-Factor and Passwordless Authentication

In today's technology-driven world, web services have opened up new opportunities for blind and visually impaired people to interact independently. Securing interactions with these services is crucial; however, currently deployed methods of web authentication mainly concentrate on sighted users, overlooking the specific needs of the blind and visually impaired community. In this paper, we address this critical gap by investigating the security and accessibility aspects of these web authentication methods when adopted by blind and visually impaired users. We model web authentication for such users as screen reader assisted authentication and introduce an evaluation framework called Authentication Workflows Accessibility Review and Evaluation (AWARE). Using AWARE, we then systematically assessed popular PC-based and smartphone-based screen readers against different types of deployed web authentication methods, including variants of 2FA and passwordless schemes, to simulate real-world scenarios for blind and visually impaired individuals. We analyzed these screen reader assisted authentication interactions with authentication methods in three settings: using a terminal (PC) with screen readers, a combination of the terminal (PC) and smartphone with screen readers, and smartphones with integrated screen readers. The results of our study underscore significant weaknesses in all of our observed screen reader assisted authentication scenarios for real-life authentication methods. These weaknesses, encompassing specific accessibility issues caused by imprecise screen reader instructions, highlight vulnerability concerning observed scenarios for both real-world and research literature based attacks, including phishing, concurrency, fatigue, cross-service, and shoulder surfing.